sources: Update ipblocklist with Threatview.io IP list

- Blocklist addition was discussed and agreed at IPFire dev conf call in March 2025.
- Tested on vm system.
- Adjusted the entry alignment for the three 3coresec entries as they had used tabs and
   all the rest used spaces for alignment. Now all entries are lined up the same.

Tested-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Adolf Belka <adolf.belka@ipfire.org>
Signed-off-by: Michael Tremer <michael.tremer@ipfire.org>

diff --git a/config/ipblocklist/sources b/config/ipblocklist/sources
index a25353528dc2c5a8c55aaaa774af4c178338f4dd..0e26792d6beb96393f54e9e9805420e41bc847b6 100644 (file)
--- a/config/ipblocklist/sources
+++ b/config/ipblocklist/sources
@@ -112,21 +112,27 @@ our %sources = ( 'EMERGING_FWRULE' => { 'name'     => 'Emerging Threats Blocklis
                                     'rate'     => '30m',
                                     'category' => 'attacker' },
              '3CORESEC_SSH'    => { 'name'     => '3CORESec SSH Activity Blocklist',
-                                        'url'      => 'https://blacklist.3coresec.net/lists/ssh.txt',
-                                        'info'     => 'https://blacklist.3coresec.net',
-                                        'parser'   => 'ip-or-net-list',
-                                        'rate'     => '1d',
-                                        'category' => 'attacker' },
+                                    'url'      => 'https://blacklist.3coresec.net/lists/ssh.txt',
+                                    'info'     => 'https://blacklist.3coresec.net',
+                                    'parser'   => 'ip-or-net-list',
+                                    'rate'     => '1d',
+                                    'category' => 'attacker' },
              '3CORESEC_SCAN'   => { 'name'     => '3CORESec Scan and IDS Blocklist',
-                                        'url'      => 'https://blacklist.3coresec.net/lists/misc.txt',
-                                        'info'     => 'https://blacklist.3coresec.net',
-                                        'parser'   => 'ip-or-net-list',
-                                        'rate'     => '1d',
-                                        'category' => 'reputation' },
+                                    'url'      => 'https://blacklist.3coresec.net/lists/misc.txt',
+                                    'info'     => 'https://blacklist.3coresec.net',
+                                    'parser'   => 'ip-or-net-list',
+                                    'rate'     => '1d',
+                                    'category' => 'reputation' },
              '3CORESEC_WEB'    => { 'name'     => '3CORESec Web Server Activity Blocklist',
-                                        'url'      => 'https://blacklist.3coresec.net/lists/http.txt',
-                                        'info'     => 'https://blacklist.3coresec.net',
-                                        'parser'   => 'ip-or-net-list',
-                                        'rate'     => '1d',
-                                        'category' => 'attacker' }
+                                    'url'      => 'https://blacklist.3coresec.net/lists/http.txt',
+                                    'info'     => 'https://blacklist.3coresec.net',
+                                    'parser'   => 'ip-or-net-list',
+                                    'rate'     => '1d',
+                                    'category' => 'attacker' },
+             'THREATVIEW_IO_IP'    => { 'name'     => 'Threatview.io Malicious IP Blocklist for known Bad IP addresses',
+                                    'url'      => 'https://threatview.io/Downloads/IP-High-Confidence-Feed.txt',
+                                    'info'     => 'https://threatview.io/#services',
+                                    'parser'   => 'ip-or-net-list',
+                                    'rate'     => '1d',
+                                    'category' => 'reputation' }
            );